Hi Ramaza,

Yes, it would be very helpful!

Unless we have an X-Ray machine for PCBs, this is the only method available to find out what is on the internal layers.

As I found out, there are mostly power planes, but there should be a few data signals, too, as I was able to determine using a DMM.

I don't know for sure how many internal layers are in, so you must be careful when grinding down the PCB.

But this would confirm for sure what's in there, and provide the full layout, not just the schematic.

Thank you for your offer, please let me know about the result, so I can integrate your work in the reverse engineering job with proper reference to it.

(Last edited by Squonk on 2 Dec 2012, 14:22)

I am happy to help. I will test different procedures for exposing the copper layers on other multilayer PCBs. In the meantime I need to buy a TL-WR703N at Ebay because they are no longer sold as new.

What about the TL-WR702N? Seems to only have less flash and RAM but perhaps same PCB.

Where did you get this information?

The TL-WR703N has always be sold in China only, as it is not RoHS/CE/FCC compliant, unlike the TL-WR702N which is sold worldwide.

Do you mean it is no longer sold as new in China too?

It is still available on the Chinese TP-Link web site as an available product, though:
http://www.tp-link.com.cn/pages/product … .asp?d=225

I don't know, I never opened one. What I can say is that externally, it is missing the USB-A connector, too.

But I don't know if it is using rhe same PCB or not: I would say probably, but...

(Last edited by Squonk on 2 Dec 2012, 18:16)

I meant I couldn't find a good supplier in central europe for the TL-WR703N. You might be right that it has never been sold here. The TL-WR702N is available and I thought it's just a downgraded successor with same PCB.

I will try to get a TL-WR703N to be on the safe side.

Maybe someone here has a broken TL-WR703N to send to you or a surplus to sell?

(Last edited by Squonk on 2 Dec 2012, 19:51)

Here's a 703N on ebay for $21.09US: http://www.ebay.com/itm/TP-LINK-TL-WR70 … 1c2c662e84

Here is one TL-WR703N for $18.86USD:
http://www.ahappydeal.com/product-48069.html

(Last edited by Squonk on 3 Dec 2012, 07:21)

Thanks, but I have to look for a supplier here in central Europe :-)

I will buy a TL-WR703N at Ebay. Shipping is free. But it will take some time as it's coming from Hong Kong.

The only two alternatives that are easily available here would be the TL-WR702N and TL-MR3020.

I have both TL-WR703N and TL-MR3020.

Although they share 90% of their schematic, BOM, and layout, they are not the same PCB. So the TL-MR3020 is not an alternative.

What I suspect is that the TL-WR702N is just a TL-WR703N with 2MB Flash + 16MB SDRAM and unpopulated USB-A, but I can't be affirmative, since I have never seen one such PCB.

If you buy one TL-WR702N, please post hires pictures of the PCB top and bottom before unsoldering, so I will be able to tell you if it is worth to grind down or not.

Thank you for your proposal!

Yes, that would be perfect, of course!

I wonder if putting an assembled unit under xrays would render something useful or not. Except for the USB-A connector, there are mainly plastic packages that should be seen as mostly transparent, shouldn't they?

Otherwise, we should try to contact Kean who did the original TL-WR703N teardown, if he still has his bare PCB to shoot...

Thank you for your compliments!

I would love to work on an open-hardware project involving this SoC and some latitude to correct the few deficiencies of the TL-WR703N design: USB low/full/high speed compatibility using a hub+microSD combo chip, a second Ethernet connector, routing of unused GPIOs, accessible UART, larger Flash/SDRAM capacities... Still fitted into this small form factor!

But you 're right, this is probably only dreams, as the AR9331 is not available as a retail part

And yes, the SoC has I2S interface (and also SLIC...), but don't forget about pin multiplexing...

My PCB is en route to ramaza for some serious inspection of the inner layers.

An open hardware project based on the AR9331 would be very welcome. I'm all for keeping it as minimal as possible: USB peripherals can be added at will by the end user by adding a simple USB hub. Accessible UART, some GPIO and larger flash should definitely be on the board.

It's not the first open hardware OpenWRT board though: the Dragino is based on the Atheros AR2317 but is a lot bigger. All Eagle files are availble on their Git-repository: https://github.com/flukso/flm02/tree/develop/eagle

Thank you!

Following my experience with USB 2.0 EHCI only in the AR9331, a hub is mandatory if you want to use any low or full speed device, and adding a microSD in the same chip would allow a smaller flash capacity and expandable memory for cheap...

Specifically, I was thinking of the AU6350-MGL chip.

But the problem is to get the AR9331 chip, anyway

X-Ray would be attractive and much faster of course. But I am not sure if the result would be as valuable as scanning every single copper layer on a flatbed scanner.

I already started some grinding tests with a blank 4 layer PCB from a good old WRT54GL. I might use a CNC milling machine as well.

I have no previous experience with this technique, but I would try to include the PCB into transparent resin to fix it on the milling machine, so even if the thickness goes very low, it will stay rigid enough.

Then the tricky part will be to have the PCB flat relative to the tool itself, so you have a chance to expose the full layers one by one at once....

(Last edited by Squonk on 4 Dec 2012, 14:51)

It sounds like a total nightmare. Are multilayer boards in some way standardised in terms of layer thickness? My guess is not, particularly given the very thin traces in the 703: bet the layers are thin too.

Is there a chemical way?

It has already been done: http://bb.osmocom.org/trac/wiki/PirelliDPL10/PCB

The copper in a PCB is rated in ounces, and represents the thickness of 1 ounce of copper rolled out to an area of 1 square foot.

Normal thickness is 1 oz (34.79 µm) or 1/2 oz (17.4  µm). But substrate thickness is not normalized and can be almost anything.

You have to remove fabric in small thickness amount.

There are probably some chemical product that would soften the substrate, but this is also probably not very good for health...

The PCB from NutBolt arrived. Thanks again!

The outer copper layers are abraded, scanned and post-processed. Tomorrow I will move on to the inner layers. This is going to be more work.

(Last edited by ramaza on 5 Dec 2012, 22:00)

Don't hurry, take your time!

It is better to practice on a less important board first

Thanks for all your efforts and thanks again to David for sacrificing his board to science!

Wow, I'm impressed by the mail: just an ordinary envelope and stamp made it halfway across Europe in one and a half day.

Please take some pictures during the process – I'd love to see how you're going to approach this.

The first inner layer is exposed. I didn't use a CNC machine so it's mostly handwork.

I made some photos of the process as well. I am afraid I can't easily post them here in the forum, right?

You have to store them somewhere and link to them.

I suggest imageshack or dropbox.

Here we go :-)

Layer1:

Layer2:

Layer3:

Layer4:

All pictures are aligned and can be easily stacked up. Everything except the traces is transparent in the PNG files.

Very nice, thank you!

I will have a look at the pictures asap!

Can you elaborate on how did you proceed?

This may be also interesting for other projects, too!

(Last edited by Squonk on 10 Dec 2012, 13:41)

Here are some photos about the grinding process:

The PCB is glued on a wood block with double sided adhesive tape. The two small pieces are from an old PCB and help to stabilize the block on the belt sander. They should be at least as thick as the middle PCB.

The belt sander is used with two different belts. A rough and a fine one.

The support pieces are grinded down to the thickness of the middle PCB. This is done with the rough belt.

Move on until the next copper layer becomes visible. Use only slight pressure and be patient. This takes some time.

Switch to the fine belt as soon as the first parts of the next copper layer become visible. Especially monitor the corners. Use the fine belt until the copper layer starts to become damaged. Monitor the corners again.

The process can't be finished on the belt sander. Stop using it as soon as the copper layer starts to get damaged. Take care to not bend the PCB too much when removing it from the wood block. Move on with manual grinding and two or three different types of sand papers. You can generate pressure on the PCB with two fingers at the exact position where you need to remove some material. The last sand paper is very fine and used for polishing.

Alternatively keep the PCB on the wood block and move the sand paper instead of the PCB. This way it's a little bit easier to grind at a specific location but it takes more time.